Dueflow API

The Dueflow API is a JSON API over HTTPS at https://api.dueflow.co. Every endpoint is versioned under /v1.

curl https://api.dueflow.co/v1/organization \
  -H "Authorization: Bearer $DUEFLOW_TOKEN"

{
  "id": "fEeIwmrA0SHPFZ3pQnJjR",
  "name": "Phi Kappa Psi National",
  "type": "national",
  "parentId": null,
  "currency": "usd",
  "contactEmail": "nationals@example.org",
  "website": null,
  "logoUrl": null,
  "isActive": true,
  "createdAt": "2026-02-09T04:48:25.813Z",
  "updatedAt": "2026-07-25T17:37:35.482Z"
}

Start with Authentication to get a token, then Sync your roster for a worked end-to-end example.

What’s in v1

Area	Read	Write
Organization	`GET /organization`	–
Chapters (nationals)	`GET /chapters`, `GET /chapters/:id/members`	–
Members	`GET /members`, `GET /members/:id`	`POST /members`, `PATCH /members/:id`
Groups	`GET /groups`, `GET /groups/:id`	`POST /groups`, `PATCH /groups/:id`, add/remove members
Payments	`GET /payments`, `GET /payments/:id`	–
Reimbursements	`GET /reimbursements`, `GET /reimbursements/:id`	`POST /reimbursements/:id/review`
Reminders	`GET /reminders`, `GET /reminders/:id`	`POST /reminders/:id/send`
Activity	`GET /audit-logs`	–

Payments are read-only in v1: money movement stays in the dashboard, where it has the confirmation and approval flows an API call can’t reproduce.

What you can access

A token is bound to exactly one organization, and every response is scoped to it. A national organization can additionally read its direct child chapters with the chapters:read scope. Member responses deliberately exclude phone numbers, guardian and emergency contacts, custom fields and internal notes. Payment responses exclude payment-provider identifiers and raw provider payloads.

Conventions

Errors share one envelope with a stable error.code. See Errors.
Writes require an Idempotency-Key, so a retry can’t apply twice. See Idempotency.
Lists are cursor-paginated and support updatedSince. See Pagination and sync.
Every response carries an X-Request-Id. Include it when you contact support – it identifies the exact request in our logs.
Timestamps are RFC 3339 in UTC; monetary amounts are decimal strings ("50.00") with the organization’s currency, never floats.

Versioning

/v1 will not change in a way that breaks a working integration: nothing is removed, no parameter becomes required, no accepted value narrows. New endpoints, fields, optional parameters and scopes are added without a version bump, so parse responses leniently. Anything incompatible goes in a /v2, and a retired endpoint announces itself with Deprecation and Sunset headers for at least 180 days first. The full policy is on the versioning and deprecation page. The machine-readable description of this version – the same one that generates this reference – is served by the API itself:

curl https://api.dueflow.co/v1/openapi.json

Getting started

Core concepts

Guides

What’s in v1

What you can access

Conventions

Versioning

​What’s in v1

​What you can access

​Conventions

​Versioning

What’s in v1

What you can access

Conventions

Versioning